wip v28

Author: geraldarthurdavis

packages/github/src/__tests__/jwt-helper.test.ts

@@ -0,0 +1,40 @@
+import { generateKeyPairSync } from 'crypto';
+import { generateGitHubAppJWT, normalizeGitHubAppPrivateKey } from '../auth/jwt-helper';
+
+function createPrivateKeyPem(): string {
+  return generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    privateKeyEncoding: {
+      type: 'pkcs8',
+      format: 'pem'
+    },
+    publicKeyEncoding: {
+      type: 'spki',
+      format: 'pem'
+    }
+  }).privateKey;
+}
+
+describe('GitHub App JWT helpers', () => {
+  it('normalizes escaped PEM newlines before signing', () => {
+    const privateKey = createPrivateKeyPem();
+    const escapedPrivateKey = privateKey.replace(/\n/g, '\\n');
+
+    expect(normalizeGitHubAppPrivateKey(escapedPrivateKey)).toBe(privateKey.trim());
+    expect(generateGitHubAppJWT('244206', escapedPrivateKey).split('.')).toHaveLength(3);
+  });
+
+  it('normalizes base64-encoded PEM values for deployment envs', () => {
+    const privateKey = createPrivateKeyPem();
+    const base64PrivateKey = Buffer.from(privateKey, 'utf8').toString('base64');
+
+    expect(normalizeGitHubAppPrivateKey(base64PrivateKey)).toBe(privateKey.trim());
+    expect(generateGitHubAppJWT('244206', base64PrivateKey).split('.')).toHaveLength(3);
+  });
+
+  it('rejects local private-key paths with an actionable configuration error', () => {
+    expect(() =>
+      normalizeGitHubAppPrivateKey('/Users/example/Downloads/bitcode.private-key.pem')
+    ).toThrow(/file path/i);
+  });
+});

packages/github/src/auth/jwt-helper.ts

@@ -15,6 +15,64 @@ function base64url(str: string): string {
     .replace(/\//g, '_');
 }
 
+const PRIVATE_KEY_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+const PRIVATE_KEY_END = /-----END [A-Z ]*PRIVATE KEY-----/;
+
+function stripWrappingQuotes(value: string): string {
+  if (value.length < 2) return value;
+
+  const first = value[0];
+  const last = value[value.length - 1];
+
+  if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+    return value.slice(1, -1);
+  }
+
+  return value;
+}
+
+function decodeBase64Pem(value: string): string | null {
+  const compact = value.replace(/\s/g, '');
+  if (!compact || compact.length % 4 !== 0) return null;
+
+  try {
+    const decoded = Buffer.from(compact, 'base64').toString('utf8').trim();
+    return PRIVATE_KEY_BEGIN.test(decoded) && PRIVATE_KEY_END.test(decoded)
+      ? decoded
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+export function normalizeGitHubAppPrivateKey(privateKey: string): string {
+  let key = stripWrappingQuotes(privateKey.trim())
+    .replace(/\\r\\n/g, '\n')
+    .replace(/\\n/g, '\n')
+    .replace(/\\r/g, '\n')
+    .replace(/\r\n/g, '\n')
+    .replace(/\r/g, '\n')
+    .trim();
+
+  if (!PRIVATE_KEY_BEGIN.test(key)) {
+    key = decodeBase64Pem(key) ?? key;
+  }
+
+  if (/^\/.*\.pem$/i.test(key) || /^[A-Z]:\\.*\.pem$/i.test(key)) {
+    throw new Error(
+      'GITHUB_PRIVATE_KEY contains a file path. Configure the deployed environment with the PEM contents or a base64-encoded PEM, not a local .pem path.'
+    );
+  }
+
+  if (!PRIVATE_KEY_BEGIN.test(key) || !PRIVATE_KEY_END.test(key)) {
+    throw new Error(
+      'GITHUB_PRIVATE_KEY must be an RSA private key PEM. Expected BEGIN/END PRIVATE KEY markers after env normalization.'
+    );
+  }
+
+  return key;
+}
+
 export function generateGitHubAppJWT(appId: string, privateKey: string): string {
   // Current time in seconds
   const now = Math.floor(Date.now() / 1000);
@@ -39,10 +97,7 @@ export function generateGitHubAppJWT(appId: string, privateKey: string): string
   // Create signature
   const signatureInput = `${encodedHeader}.${encodedPayload}`;
 
-  // Parse the private key (handle both raw and escaped formats)
-  const privateKeyContent = privateKey
-    .replace(/\\n/g, '\n')
-    .trim();
+  const privateKeyContent = normalizeGitHubAppPrivateKey(privateKey);
 
   const sign = crypto.createSign('RSA-SHA256');
   sign.update(signatureInput);
@@ -57,4 +112,4 @@ export function generateGitHubAppJWT(appId: string, privateKey: string): string
 
   // Combine all parts
   return `${encodedHeader}.${encodedPayload}.${encodedSignature}`;
-}
+}

uapi/.env.example

@@ -84,7 +84,7 @@ BITBUCKET_REDIRECT_URI=<your domain>/api/integrations/bitbucket/callback
 GITHUB_OAUTH_CLIENT_ID=<your GitHub App OAuth client ID>
 GITHUB_OAUTH_CLIENT_SECRET=<your GitHub App OAuth client secret>
 GITHUB_APP_ID=<your GitHub App ID>
-GITHUB_PRIVATE_KEY=<your GitHub App private key (RSA format)>
+GITHUB_PRIVATE_KEY=<your GitHub App RSA private key PEM contents, escaped-newline PEM, or base64-encoded PEM; not a local .pem file path>
 GITHUB_WEBHOOK_SECRET=<webhook signature verification secret>
 # Google Generative AI (Gemini)
 GOOGLE_API_KEY=<your Google API key>